Privacy Policy

Last updated: March 2026

In this Privacy Policy, 'us', 'we' or 'our' means Planaji, operated by Zithera Technology Pty Ltd (ABN: [INSERT ABN]). We are committed to respecting your privacy and handling personal information responsibly. This Privacy Policy sets out how we collect, use, store and disclose personal information in connection with the Planaji platform, which is used by NDIS registered plan managers to manage participant budgets, invoices, subcontractors and related services.

We are bound by the Australian Privacy Act 1988 (Cth) (the Privacy Act), the Australian Privacy Principles (APPs), the Notifiable Data Breaches (NDB) scheme, and relevant requirements of the NDIS Quality and Safeguards Commission.


1. Who This Policy Applies To

This policy applies to:

  • Plan managers — organisations and individuals who subscribe to Planaji to manage NDIS participant plans;
  • Participants — NDIS participants whose plan data is managed through Planaji by their plan manager;
  • Nominees and contacts — individuals nominated by or on behalf of participants to act in a representative capacity, or listed as emergency or personal contacts within the platform;
  • Support coordinators — individuals who coordinate supports for participants and whose details are entered into the platform by plan managers;
  • Subcontractors — service providers and contractors engaged by plan managers whose details are entered into the platform;
  • Care workers — individuals who use the Planaji care worker mobile app to submit timesheets, case notes and related records;
  • App users — any individual accessing Planaji services via the mobile application, including subcontractors and care workers;
  • Website visitors — individuals visiting planaji.com.

2. What Personal Information We Collect

We collect the following categories of personal information:

Plan Manager Account Information

  • Organisation name, ABN, contact name, email address, phone number
  • Login credentials (passwords are hashed and never stored in plain text)
  • Billing and subscription information

NDIS Participant Data (processed on behalf of plan managers)

  • Full name, date of birth, NDIS number, contact details
  • NDIS plan details: funding categories, budget allocations, plan start and end dates
  • Invoice and payment records relating to support services
  • Documents uploaded by plan managers (e.g. plan documents, agreements, identification)

Subcontractor and Support Coordinator Data

  • Name, contact details, ABN, bank account details (for remittance)
  • Documents uploaded for compliance purposes (e.g. worker screening, insurance certificates)

System and Usage Data

  • IP addresses, browser type, device information
  • Activity logs and audit trails within the platform
  • Email open/delivery metadata

3. How We Collect Personal Information

We collect personal information:

  • Directly from plan managers when they register, configure their account, and use the platform;
  • When plan managers enter participant, subcontractor, or other third-party data on behalf of their clients;
  • Automatically through platform usage, including system logs and audit trails;
  • Via email integrations (where plan managers connect their email to process invoices);
  • From website contact and demo request forms.

Where a plan manager enters NDIS participant data into Planaji, the plan manager is responsible for ensuring they have appropriate authority to share that information with us, and that participants have been notified in accordance with their own obligations.


4. Why We Collect and Use Personal Information

We collect and use personal information to:

  • Provide and operate the Planaji platform and related services;
  • Process NDIS invoices, budgets and plan management records on behalf of plan managers;
  • Send transactional communications (e.g. invoice approvals, remittances, budget alerts, document expiry reminders);
  • Provide account support and respond to enquiries;
  • Maintain system security and audit trails;
  • Comply with legal obligations including NDIS Practice Standards, the Privacy Act, and Australian tax law;
  • Improve platform functionality (using de-identified or aggregated data only).

We will not use personal information for any purpose that is incompatible with these purposes without your consent.


5. NDIS-Specific Data Handling

Planaji acknowledges its obligations in relation to NDIS participant data under the NDIS Quality and Safeguards Commission requirements and the NDIS Practice Standards.

  • NDIS participant data is only accessed by authorised Planaji staff for the purpose of supporting plan managers in delivering the service;
  • We do not sell, share, or use participant data for any purpose other than delivering the Planaji service;
  • Plan managers retain ownership of all participant data they upload or create within the platform;
  • Upon termination of a plan manager's subscription, participant data is available for export for a period of 30 days, after which it is securely deleted or de-identified, unless a longer retention period is required by law.

6. Data Retention

We retain personal information for the following periods:

  • NDIS participant records: Minimum 7 years from the date of last service, in accordance with NDIS Practice Standards;
  • Financial and invoice records: 7 years, in accordance with Australian tax law;
  • Plan manager account data: For the duration of the subscription and 12 months after account closure;
  • System logs and audit trails: 2 years;
  • Website enquiry data: 12 months.

After the applicable retention period, data is securely deleted or de-identified. We do not retain data indefinitely.


7. Disclosure of Personal Information

We may disclose personal information to:

  • Cloud infrastructure providers: Planaji is hosted on Amazon Web Services (AWS), including servers located in Australia and the United States. Data stored on AWS S3 and EC2 is subject to AWS's security and data handling practices;
  • Email delivery services: We use AWS Simple Email Service (SES) to deliver transactional emails;
  • Push notification services: Firebase Cloud Messaging (FCM) is used to deliver push notifications to the Planaji mobile app;
  • Payment processors: Where relevant to billing;
  • Legal and regulatory bodies: Where required by law, including the NDIS Quality and Safeguards Commission, the Office of the Australian Information Commissioner (OAIC), or law enforcement agencies;
  • Professional advisors: Such as lawyers and accountants, under confidentiality obligations.

We will never sell your personal information to third parties. We do not disclose personal information for direct marketing by third parties.

Overseas disclosure (APP 8): Some third-party service providers (including AWS and Firebase/Google) operate infrastructure outside Australia. Our primary AWS infrastructure is located in Sydney (ap-southeast-2), with US-based replication for redundancy and disaster recovery purposes. Where personal information is transferred overseas, we take the following specific steps to ensure it remains protected:

  • Contractual obligations requiring AWS, Google and other overseas providers to comply with the Australian Privacy Principles or equivalent standards;
  • All data transmitted to overseas infrastructure is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256;
  • Access to overseas-hosted data is subject to the same role-based access controls applied to Australian-hosted data;
  • We only use overseas providers who maintain internationally recognised security certifications (e.g. ISO 27001, SOC 2).

Planaji remains accountable under the Privacy Act for the handling of your personal information by these overseas recipients.


8. Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Our security measures include:

  • All data is encrypted in transit (TLS/HTTPS) and at rest (AWS server-side encryption);
  • Documents and attachments are stored in private AWS S3 buckets with access-controlled signed URLs;
  • Passwords are hashed using industry-standard algorithms and never stored in plain text;
  • Role-based access controls limit data access to authorised users within each plan manager's tenancy;
  • Activity and audit logs are maintained for all significant system actions;
  • Multi-tenant architecture ensures plan manager data is isolated from other tenants.

No method of internet transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of any security vulnerabilities or incidents, please contact us immediately at support@planaji.com.


9. Notifiable Data Breaches

We comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act. In the event of an eligible data breach:

  • We will contain the breach and assess its scope within 30 days;
  • We will notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable;
  • We will notify affected individuals directly, including a description of the breach, the information involved, and recommended steps they can take;
  • For reportable incidents under the NDIS Act 2013 — including data breaches that may impact participant safety or wellbeing — Planaji will notify the NDIS Quality and Safeguards Commission within 24 hours of becoming aware of the incident;
  • We will conduct a post-incident review and implement remediation measures.

Plan managers must notify Planaji immediately upon becoming aware of any suspected or actual breach involving their Planaji account.


10. Cookies and Tracking

The Planaji platform uses the following cookies:

  • Session cookies: Required for authentication and platform functionality. These are deleted when you close your browser;
  • Remember Me cookies: If selected at login, your session is persisted for up to 14 days;
  • CSRF protection cookies: Used to protect against cross-site request forgery attacks;
  • Preference cookies: Storing display preferences such as table settings. These expire after 1 year.

We do not use advertising trackers, third-party analytics cookies, or any cookies for behavioural advertising. Essential cookies cannot be disabled as they are required for the platform to function.


11. Access to and Correction of Personal Information

You have the right to request access to personal information we hold about you, and to request correction of information that is inaccurate, incomplete or out of date.

To make an access or correction request, contact us at support@planaji.com. We will respond within 30 days. In some circumstances we may decline access (for example, where access would unreasonably impact the privacy of another individual, or where required by law). If we decline, we will explain why in writing.

Plan managers can access and update most of their account data and participant records directly within the Planaji platform.


12. Complaints

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer at:

Email: support@planaji.com
Subject line: Privacy Complaint

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.


13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The current version will always be available at planaji.com/privacy-policy. For material changes, we will notify active plan managers by email at least 30 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.


14. Contact Us

For any questions about this Privacy Policy or our privacy practices, please contact us:

Planaji — Zithera Technology Pty Ltd
Email: support@planaji.com
Website: planaji.com